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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

1 . (Currently Amended) A directory system for providing directory services 
in a communications network using stored directory objects, the directory system 
comprising: 

a network interface providing access to the directory system from a 
communications network; 
memory means ;-and 
at least one processor; and 

service componen ts providing services to users o f the directory s ystem based on 
stored directory object attributes associa te d with said services, said services including 
identity-based servi ces based on identity management attributes for said users; 

wherein the directory ebteets-afe^tefedsystem stores in said memory means-as 
directory data representing directory objects , said directory data including the following 
subse ts o f data : 

attribute data representing attributes of said directory objects, each attribute 
including an attribute type and a corresponding value: 
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directory information tree (DIT) data repfeseHtiag-a associating said 
attributes with corresponding: nodes of at least one hierarchical directory 
information tree st ructure ( DIT) for said directory objects[[,]]; and 

management data for managing said directory objects and said at least one 
DIT ; and 

wherein-pertie es of said m emory- means - c onstattrte . the directory system stores the 
directory da ta in a memory resident database, subsets of the directory data, being stored in 
a segregate d manne r by storing each subset of related data in one or more memory 
segments dedicated to storage of €w«ssfH=ffltdin^-^^ 

each sai d memory segment being a contiguous portion of said memory means , said 
memory segments including (a) one or more attribute segments, each of said attribute 
segments being dedicated to storage of attribute data for a plurality of directory objects, 
(b) one or more DIT segments, each of said DIT segments being dedicated to storage of 
DIT data for a plurality of directory objects, and (c) one or more object segments, each of 
said object segments being dedicated to storage of management data for a plurality of 
directory objects ; and 

wherein eac h o f said services is associated with one or more corresponding ones 
of said att ributes, the attribute data stored in the attribute segments being further 
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segregated on the basis of these associations to facilitate processing of said attributes bv 
said service components . 

2. (Previously Presented) A directory system as claimed in claim 1 , wherein 
said directory system is configured to allocate portions of said memory means to provide 
said memory segments. 

3. (Currently Amended) A directory system as claimed in claim 1 , wherein 
each of said attribute segments includes-ene-ef-Biere attribute sub-segments dedicated to 
storage of attribute data for respective object classes. 

4. (Currently Amended) A directory system as claimed in claim 1, wherein 
each of said attribute segments includes- one or mo re attribute sub-segments dedicated to 
storage of attribute data for respective attribute types, wherein eac h of said attribute sub- 
segments is dedicated to storage of attribute data, for a corresponding attribute type and 
for a plurality of directory objects . 

5. (Currently Amended) A directory system as claimed in claim 1 , wherein 
each of said attribute segments includes-^n^er-mwe attribute sub-segments dedicated to 
storage of attribute data for attributes ^corresponding to respective attribut e 
typesservices. 
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6. (Original) A directory system as claimed in claim 1, wherein said attribute 
segments store attribute data for respective portions of a directory information tree (DIT). 

7. (Previously Presented) A directory system as claimed in claim 1, wherein 
the attribute data stored in one or more attribute segments are grouped according to one 
or more of object class, attribute type, attribute, and portion of a DIT. 

8. (Previously Presented) A directory system as claimed in claim 5, wherein 
said attribute data includes a normalized attribute value and a hash value for each 
attribute value. 

9. (Previously Presented) A directory system as claimed in claim 8, wherein 
the directory system generates and stores a hash value for each relative distinguished 
name in said attribute sub-segments. 

1 0. (Original) A directory system as claimed in claim 5, wherein said attribute 
data includes a context prefix identifier of a corresponding entry, and a relative 
distinguished name identifier of said entry. 

1 1 . (Original) A directory system as claimed in claim 5, wherein said attribute 
data includes data indicating whether each of said attributes is associated with one or 
more other attributes. 
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12. (Original) A directory system as claimed in claim 5, wherein said attribute 
data includes data indicating whether each of said attributes is a sponsoring attribute for 
one or more other attributes. 

1 3 . (Previously Presented) A directory system as claimed in claim 1 , wherein 
attributes having the same object naming characteristics are stored together. 

14. (Original) A directory system as claimed in claim 13, wherein the object 
naming characteristics of an attribute correspond to one of distinguished attributes, 
aliased distinguished names, and non-naming attributes. 

15. (Previously Presented) A directory system as claimed in claim 1 , wherein 
attributes having the same directory information characteristics are stored together. 

16. (Previously Presented) A directory system as claimed in claim 15, wherein 
the directory information characteristics of an attribute correspond to one of collective 
attributes, compound attributes, attributes of compound attributes, X.500/LDAP opera- 
tional attributes, user operational attributes, sponsoring attributes, and other attributes. 

17. Cancelled. 

1 8. (Previously Presented) A directory system as claimed in claim 1, wherein 
said management data includes security data. 
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19. (Previously Presented) A directory system as claimed in claim 1, wherein 
said object segments include a first object segment for storing distinct name binding rules 
for directory objects, and at least one second object segment for storing other object data 
for said directory objects. 

20. (Previously Presented) A directory system as claimed in claim 1, wherein 
said object segments include a first object segment for storing access control data for 
directory objects, and at least one second object segment for storing other object data for 
said directory objects. 

2 1 . (Currently Amended) A directory system as claimed in claim 20, wherein 
the directory system i s ada p ted t o generates one or more access control identifiers for a 
user on the basis of access configuration information for said user, and [[to]] determines 
said user's access to a directory object on the basis of at least one access control 
ide nt i fi ers -identifier associated with said object and at least one access control identifier 
associated with said user. 

22. (Original) A directory system as claimed in claim 2 1 , wherein said one or 
more access control identifiers identify one or more of a specific user, a group of users, 
and a generic user. 
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23. (Original) A directory system as claimed in claim 2 1 , wherein each access 
control identifier includes respective components for accessing a selected D1T, for 
performing a selected directory operation, for accessing a selected attribute group, and for 
accessing a selected attribute type. 

24. (Original) A directory system as claimed in claim 2 1 , wherein said access 
control data includes one or more access control identifiers for each directory object, and 
hierarchical access data defining access to a DIT, a directory operation, an attribute 
group, and an attribute type. 

25. (Previously Presented) A directory system as claimed in claim 1 , wherein 
each of said object segments includes one or more object sub-segments, each of said 
object sub-segments including object cells for storing DIT schema data and access 
control data for controlling access to a DIT or a portion of a DIT. 

26. (Original) A directory system as claimed in claim 24, wherein said access 
control data includes one or more numeric access control identifiers. 

27. (Previously Presented) A directory system as claimed in claim 25, wherein 
the directory system generates access control identifiers on the basis of user configuration 
data specifying user access to one or more parts of a DIT and stores said access control 
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identifiers in object sub-segment cells corresponding to said one or more parts of said 
DIT. 

28. (Previously Presented) A directory system as claimed in claim 20, wherein: 
the directory system generates a directory operation access control identifier for 

use in determining whether a user is granted access to perform a selected directory 
operation on a selected attribute type in a selected portion of a DIT, said directory 
operation access control identifier identifying said directory operation, said portion of 
said DIT and said attribute type, and 

the directory system determines whether said access is granted on the basis of a 
comparison of said directory operation access control identifier with one or more access 
control identifiers associated with one or more of said portion of said DIT, said attribute 
type, and an attribute type group including said attribute type. 

29. (Previously Presented) A directory system as claimed in claim 20, wherein 
the directory system is adapted to generate one or more access control identifiers 

for a user on the basis of access configuration information for said user, and 

a trusted operating system is used to determine said user's access to a directory 
object on the basis of access control identifiers associated with said object and said user. 
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30. (Previously Presented) A directory system as claimed in claim 20, wherein: 
the directory system generates one or more access control identifiers for a user on 

the basis of access configuration information for said user, and 

the directory system includes an attribute processor adapted to determine said 
user's access to a directory object on the basis of access control identifiers associated 
with said object and said user. 

31. Cancelled. 

32. (Currently Amended) A directory system as claimed in claim 1 , wherein 
each DIT segment includes one or more DIT sub-segments, each of said DIT sub- 
segments including DIT cells storing references to non-leaf entries of a directory 
information tree. 

33. (Previously Presented) A directory system as claimed in claim 32, wherein 
said DIT sub-segments store references to respective portions of a DIT. 

34. (Previously Presented) A directory system as claimed in claim 33, wherein 
said portions correspond to selected portions of a DIT having a flat namespace. 

35. (Original) A directory system as claimed in claim 32, wherein two or more 
DIT sub-segments represent portions of a DIT having a flat namespace. 
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36. (Previously Presented) A directory system as claimed in claim 35, wherein 
two or more of said DIT sub-segments store references to a selected portion of a D1T. 

37. (Previously Presented) A directory system as claimed in claim 36, wherein 
each of said references includes a name and a prefix. 

38. (Original) A directory system as claimed in claim 36, wherein each of said 
references includes a distinguished name prefix and a hash value for said distinguished 
name prefix. 

39. (Original) A directory system as claimed in claim 27, wherein one or more 
of said DIT sub-segments includes one or more access control identifiers for controlling 
access to a corresponding DIT sub-segment. 

40. Cancelled. 

41. (Previously Presented) A directory system as claimed in claim 1, wherein 
each of said DIT segments identifies one or more object segments having stored therein 
management data for objects of the DIT segment, and one or more attribute segments 
having stored therein attribute data for said objects. 
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42. (Previously Presented) A directory system as claimed in claim 1, wherein 
said management data includes name binding rules and access control data for said 
directory objects. 

43. (Currently Amended) A directory system as claimed in claim 1 , wherein 
said plu ralit y o f memory segments include s a plural rty-ef transaction segments &f 
stering dedicated to storage of transaction data representing phases of a directory 
transaction to allow recovery of said directory transaction. 

44. (Original) A directory system as claimed in claim 43, including a 
transaction management component for updating said transaction data during said phases 
of a directory transaction. 

45. (Original) A directory system as claimed in claim 44, wherein said 
transaction management component is adapted to recover directory data on the basis of 
said transaction data. 

46. (Currently Amended) A directory system as claimed in claim 1 , wherein 
sai d plurality of memory segments imkides include at least one adaptation segment for 
steaa gdedicated to storage of adaptation data representing the usage of said memory 
segments. 
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47. (Currently Amended) A directory system as claimed in claim 46, wherein 
said adaptation data represents the organisation of directory data stored in said- plurality 
of memory segments. 

48. (Original) A directory system as claimed in claim 1, including an 
adaptation component for automatically reconfiguring said memory segments on the 
basis of usage of said memory segments. 

49. (Original) A directory system as claimed in claim 48, wherein said 
reconfiguring includes segregating one or more portions of said directory data on the 
basis of access frequencies for said one or more portions of said directory data, 

50. (Original) A directory system as claimed in claim 48, wherein said 
reconfiguring includes segregating one or more portions of said directory data on the 
basis of the number of instances of an entity of said directory data in a region of memory. 

5 1 . (Original) A directory system as claimed in claim 48, wherein said 
reconfiguring includes segregating instances of an attribute type from a name space into 
two or more regions of memory. 
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52. (Original) A directory system as claimed in claim 48, wherein said recon- 
figuring includes segregating instances of an object class into two or more regions of 
memory. 

53. (Original) A directory system as claimed in claim 48, wherein said 
reconfiguring includes segregating one or more portions of said directory data on the 
basis of access control data for said one or more portions of said directory data. 

54. (Original) A directory system as claimed in claim 48, wherein said 
reconfiguring includes aggregating directory data for a multi-object entity. 

55. (Currently Amended) A directory system as claimed in claim 1, wherein 
the directory system is a da pt ed to s t ore stores selected portions of said directory data in 
respective regions of random access memory, and to stor e stores other portions of said 
directory data in backing store, 

56. (Currently Amended) A directory system as claimed in claim 1, including 
a-plwatty^ modules for accessing and managing said plurality of memory segments. 

57. (Original) A directory system as claimed in claim 56, including a statistical 
module for generating statistical data in relation to directory entries. 
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58. (Original) A directory system as claimed in claim 56, including a 
monitoring module for monitoring one or more directory entries and for generating 
notification data in response to modification of a monitored directory entry. 

59. (Original) A directory system as claimed in claim 56, including a 
collective attributes module for segregating collective attributes of entries within a name 
space. 

60. (Original) A directory system as claimed in claim 56, including a 
validation module for validating one or more certificate paths. 

6 1 . (Original) A directory system as claimed in claim 56, including a multi- 
object management module for processing two or more objects as an entity. 

62. (Original) A directory system as claimed in claim 61, wherein said two or 
more objects include a sponsoring object and one or more sponsored objects. 

63. (Original) A directory system as claimed in claim 62, wherein said multi- 
object management module is adapted to automatically generate said one or more 
sponsored objects when a sponsoring object is generated. 
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64. (Original) A directory system as claimed in claim 63, wherein said multi- 
object module is adapted to initialise attributes and access controls of said sponsored 
objects when a sponsoring object is generated. 

65. (Original) A directory system as claimed in claim 63, wherein said multi- 
object module is adapted to automatically generate one or more objects related to a user 
object when said user object is generated. 

66. (Previously Presented) A directory system as claimed in claim 65, wherein 
said user object represents a user, and said one or more objects represent one or more 
services for said user. 

67. (Previously Presented) A directory system as claimed in claim 66, wherein 
said one or more services includes a presence service. 

68. (Currently Amended) A directory system as claimed in claim 5^ 

ffi£4udffijg l , wherein the identity-based service components include a user presence 
rw>4*rie49r--^^ component that maintains 

presence attributes of said user s, said presence attributes including an attribute that 
indicates whether a user is using a directory. 
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69. (Currently Amended) A directory system as claimed in claim 68, wherein 
said user presence module is ad apt ed - te - geneF - a : te management component generates one 
or more events in response to a change in said user presence data attributes for each user . 

70. (Original) A directory system as claimed in claim 56, including a service 
authorization module for determining whether a user is authorised to use one or more 
services. 

71. (Original) A directory system as claimed in claim 70, wherein said service 
authorization module is adapted to perform said determining in response to a directory 
search. 

72. (Original) A directory system as claimed in claim 7 1 , wherein said 
directory search is based on an authorisation matching rule, service and device properties, 
and an authorisation token. 

73. (Original) A directory system as claimed in claim 56, including a relational 
search module for performing a distributed object relational search in response to a 
search query including relational operators. 

74-76. Cancelled. 
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77. (Currently Amended) A directory system as claimed in claim [[74]]I, 
including one or more messaging gateway modules for communicating with remote 
messaging systems using one or more messaging protocols. 

78. (Original) A directory system as claimed in claim 1, including at least one 
attribute processor adapted to store and process attribute data of a directory. 

79. (Original) A directory system as claimed in claim 78, wherein said 
attribute processor includes an application-specific integrated circuit. 

80. (Currently Amended) A directory system as claimed in claim 1 including 
one or more messaging-medules-fer service co mponents providing4Fa^=iS€0tieBa4 
messaging services tefor users of the directory system based on messaging at tributes for 
said . users. 

81. (Currently Amended) A directory system as claimed in claim 80, wherein 
said-tran- sactional messaging services include at least one of email and instant messaging 

82. (Currently Amended) A directory system as claimed in claim 80, wherein 
said one or more messaging-m odules are-adapted-te service components store message 
data as one or more objects in said directory. 
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83. (Currently Amended) A directory system as claimed in claim 80, wherein 
sai d tra nsactional messaging service s ore adapted to components store a user's mail box 
and address book as objects in a directory. 

84-101. Cancelled. 

102. (Previously Presented) The directory system of claim 1, wherein said 
memory segments are virtual memory segments, said memory means including physical 
random access memory and backing store. 

103. (Previously Presented) The directory system of claim 1, wherein said 
memory segments are configured as shared memory. 

104. (Previously Presented) The directory system of claim 103, wherein the 
system is configured to execute a plurality of virtual machines configured to access said 
memory segments of said shared memory. 

105. (Currently Amended) The directory system of claim 1, wherein the system 
i s confi g u r e d , t o dynamically creates, destroys, and/or resizes said memory segments. 

106. (Currently Amended) A directory process-fer- providing directory services 
in a communications network using stored directory objects, the directory process being 
executed by a computer system, and including: 
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storing directory data, representing directory objects in computera memory-as 
dir-eetor-y-(iat% allocating porti o ns - of- computer ■ memor y-4e^wi4@-t»e fflor> 1 ' segments 
de4i^3ated4e-f^^ dxrta-represenling-feeetefy 
ebieet-Sr resident database, said directory data including the following subsets of data : 
(1) attribute data representing attributes of said directory objects, each 
attribute including an attribute type and a. cor responding value: 

(ID directory information tree (DIT) data fepfesen^nff^ associating said 
attributes with cor re sponding nodes of at least one hierarchical directory 
information tree (DIT) structure for said directory objects [[,]]• and 

(iii) management data for managing said directory objects ? and said at 
least one DIT; and 

providing services to users based on stored director y object attributes associated 
with said services, said services including identity-based on identity management 
attributes for said users: 

wherein subsets of the directory data are stored in a segregated manner bv storing 
each subset of related data in one or more memory seg ments d edicated to storage of thai. 
subset, eac h memory segment being a contiguous portion of said memory means. 

said memory segments including one or more attribute segments, each of said 
attribute segments being dedicated to storage of attribute data for a plurality of directory 
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objects, one or more DIT segments, each of said DIT segments being dedicated to storage 
of DIT data for a plurality of directory objects, and one or more object segments, each of 
said object segments being dedicated to storage of management data for a plurality of 



directory objects 




wherein e ach of said services is associated with one or m o re corresponding ones 
of said attributes, the attribute data stored in the attri bute segments being further 
segregated on the basis of these associations to facilitate processing of said attributes to 
provide said services . 

107. (Currently Amended) A process as claimed in claim [[104]] 106, wherein 
said memory segments are virtual memory segments. 

108. (Currently Amended) A process as claimed in claim 106, including: 
monitoring directory data stored in a-p Utrality-of said memory segments; and 
redistributing at least a portion of said directory data in said plurality of memory 

segments based on said monitoring to improve performance of said directory services. 

109. (Previously Presented) A process as claimed in claim 108, wherein said 
monitoring includes at least one of monitoring usage of said directory data, monitoring 
depth of a portion of a DIT, monitoring spread of a portion of a DIT, monitoring the 
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number of instances of entities of said directory data, monitoring search times for said 
directory data, and monitoring the association of access control data with one or more 
directory objects. 

1 10. (Previously Presented) A process as claimed in claim 109, wherein said 
entities include at least one of attributes, object classes, and directory objects. 

111. (Previously Presented) A process as claimed in claim 1 08, wherein said 
step of monitoring includes monitoring associations of access control data with portions 
of directory data, and said step of redistributing includes storing one or more portions of 
said directory data with one or more associated portions of said access control data. 

1 12. (Previously Presented) A process as claimed in claim 111, wherein said 
monitoring includes determining that one or more access control identifiers applies to a 
portion of a DIT, and said redistributing includes storing said portion of said DIT with 
said one or more access control identifiers. 

113. (Previously Presented) A process as claimed in claim 111, wherein said 
monitoring includes determining that one or more access control identifiers applies to 
instances of an attribute type, and said redistributing includes storing said instances of 
said attribute type with said one or more access control identifiers. 
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1 14. (Previously Presented) A process as claimed in claim 108, including 
generating at least one new memory segment and wherein said step of redistributing 
includes storing at least a portion of said directory data in said at least one new memory 
segment. 

1 1 5. (Previously Presented) A process as claimed in claim 108, wherein said 
step of redistributing includes storing respective portions of said directory data stored in a 
memory segment in two or more memory segments. 

1 16. (Previously Presented) A process as claimed in claim 108, wherein said 
step of redistributing includes selecting portions of said directory data stored in two or 
more memory segments and storing the selected portions into one memory segment. 

1 17. (Previously Presented) A process as claimed in claim 108, wherein said 
step of redistributing includes selecting object class information, access control 
information, and DIT structure information that applies to at least one portion of a DIT, 
storing the selected information in at least one object segment, and associating the 
selected information with at least a portion of at least one DIT segment corresponding to 
said at least one portion of said DIT. 

1 1 8. (Previously Presented) A process as claimed in claim 108, including 
monitoring usage of remote directory data and storing at least a portion of said remote 
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directory data in at least one local memory segment based on said usage to improve 
performance of said directory services. 

1 19. (Previously Presented) A process as claimed in claim 108, wherein said 
redistributing includes redistributing directory data from a memory segment into two or 
more memory segments, 

120. (Previously Presented) A process as claimed in claim 108, wherein said 
monitoring includes monitoring the number of instances of directory data in a memory 
segment. 

121. (Previously Presented) A process as claimed in claim 108, wherein said 
monitoring includes monitoring search, times for said directory data. 

122. (Previously Presented) A process as claimed in claim 108, wherein said 
redistributing includes segregating directory data based on access frequencies for said 
directory data. 

123. (Previously Presented) A process as claimed in claim 109, wherein said 
reconfiguring includes aggregating directory data for a multi-object entity. 

124. (Previously Presented) A directory system having components for 
executing the steps of claim 106. 
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125. (Previously Presented) A computer-readable storage medium having stored 
thereon computer program instructions for executing the steps of claim 106. 

126. (New) A process as claimed in claim 106, including providing identity- 
based services to users, based on identity management attributes for said users. 

127. (New) A process as claimed in claim 126, including maintaining presence 
attributes of said users, said presence attributes including an attribute that indicates 
whether a user is using a directly. 

128. (New) A process as claimed in claim 127, including generating one or 
more events in response to a change in said user presence attributes for each user. 

129. (New) A process as claimed in claim 127, wherein said presence attributes 
include attributes representing at least four of on-line, location, device type, profile, 
security level, and inform list. 

130. (New) A process as claimed in claim 106, including providing messaging 
services for users of the directory system based on messaging attributes for said users. 

131. (New) A process as claimed in claim 130, wherein said messaging services 
include at least one of email and instant messaging. 
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132. (New) A process as claimed in claim 130 } including storing message data 
as one or more objects in said directory, 

133. (New) A process as claimed in claim 106, including storing a user's mail 
box and address book as objects in a directory. 

134. (New) A directory process as claimed in claim 106, wherein stored 
attributes are segregated by service, so that the attributes associated with each service are 
stored in one or more corresponding attribute segments distinct from attribute segments 
storing attributes associated with other services. 

135. (New) A directory process as claimed in claim 106, including storing 
subsets of attributes associated with respective services in respective attribute sub- 
segments of said attribute segments. 

136. (New) A directory system as claimed in claim 1, wherein stored attributes 
are segregated by service, so that the attributes associated with each service are stored in 
one or more corresponding attribute segments distinct from other attribute segments 
storing attributes associated with other services. 
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137. (New) A directory system as claimed in claim 1 , wherein each of said 
attribute segments includes attribute sub-segments dedicated to storage of attribute data 
associated with respective services. 

138. (New) A directory system as claimed in claim 68, wherein said presence 
attributes include attributes representing at least four of on-line, location, device type, 
profile, security level, and inform list. 
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